WordFence announced that four hosting businesses had found a vulnerability. WordFence warns that while the vulnerability has been patched, locations may have been hacked before fixing.
Server settings permitted hackers to generate WordPress administrator accounts with rogue code added to the WordPress theme from which the sites could be accessed.
WordFence urged site administrators to check for rogue administrator accounts on their locations if they are hosted on iPage, FatCow, PowWeb, or NetFirm. The same firm, Endurance International Group, owns all four.